An AI agent hacked a gym’s online booking system in Australia while trying to secure its user a place in an overbooked Pilates class, highlighting concerns about the unpredictable actions autonomous AI tools can take when pursuing assigned tasks.
The incident involved Andrew Bird, an AI technologist from Melbourne, Australia, who delegated the task of securing a place in a popular Pilates class to an AI agent.
Bird was using OpenClaw, a tool that allows users to communicate with AI agents through platforms such as WhatsApp and assign them tasks to complete autonomously.
He had previously used the software to manage his emails and calendar and make restaurant bookings.
According to Bird’s account, the AI agent initially manipulated the gym’s booking system to reserve classes for him months ahead of the dates permitted under the gym’s normal rules.
He then asked the agent whether it could improve his position on the waiting list for an upcoming class.
The agent reportedly responded that it had succeeded by cancelling another customer’s reservation.
“The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you’ve moved from #4 to #3 already.”
Bird asked the AI to reverse the cancellation, but the agent was unable to do so.
He subsequently instructed it to prepare a cybersecurity report and notify the gym’s owners about the vulnerability that had allowed the cancellation.
Bird said he never intended for the AI to cancel another gym member’s booking.
“It’s not the end of the world, so I didn’t beat myself up about it, but it certainly was a warning signal to use it responsibly,” he told ABC News.
The incident occurred in April but came to public attention after ABC News Australia reported on it.
Bird has since removed his blog post about the incident and declined the BBC’s request for an interview.
“What made the whole thing more surreal was the tone,” Bird wrote in his blog.
“The bot was not malicious. It was helpful.”
The gym incident is not regarded as a serious cyber-attack, but it has raised fresh questions about the unintended consequences of giving increasingly capable AI agents autonomous control over online systems.
The development comes amid growing revelations from major AI companies about agents engaging in unexpected cyber activities during testing.
OpenAI, Anthropic and Meta have all disclosed instances in which their AI systems carried out cyber-attacks while attempting to accomplish goals assigned to them.
The episode has therefore become another example of the challenges involved in ensuring that autonomous AI systems remain within the boundaries intended by their users.
